where ρ i (x, y i ) denotes the cost of changing the i-th cover element from x i to y i. With the syndrome coding, the minimal

Transcription

1 814 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 9, NO. 5, MAY 2014 Uniform Embedding for Efficient JPEG Steganography Linjie Guo, Student Member, IEEE, Jiangqun Ni, Member, IEEE, and Yun Qing Shi, Fellow, IEEE Abstract Steganography is the science and art of covert communication, which aims to hide the secret messages into a cover medium while achieving the least possible statistical detectability. To this end, the framework of minimal distortion embedding is widely adopted in the development of the steganographic system, in which a well designed distortion function is of vital importance. In this paper, a class of new distortion functions known as uniform embedding distortion function (UED) is presented for both side-informed and non side-informed secure JPEG steganography. By incorporating the syndrome trellis coding, the best codeword with minimal distortion for a given message is determined with UED, which, instead of random modification, tries to spread the embedding modification uniformly to quantized discrete cosine transform (DCT) coefficients of all possible magnitudes. In this way, less statistical detectability is achieved, owing to the reduction of the average changes of the first- and second-order statistics for DCT coefficients as a whole. The effectiveness of the proposed scheme is verified with evidence obtained from exhaustive experiments using popular steganalyzers with various feature sets on the BOSSbase database. Compared with prior arts, the proposed scheme gains favorable performance in terms of secure embedding capacity against steganalysis. Index Terms JPEG steganography, minimal-distortion embedding, uniform embedding, distortion function design. I. INTRODUCTION STEGANOGRAPHY is the science and art of covert communication where the sender embeds secret message into an original image (cover) with a shared key to generate a stego image. To conceal the very existence of communication, the stego image has to be statistically undetectable from its cover counterpart [1]. Therefore, the two conflicting objectives, i.e., undetectability and embedding payload, should be carefully considered when devising a steganographic scheme. Denote Manuscript received August 18, 2013; revised January 6, 2014 and February 20, 2014; accepted March 4, Date of publication March 20, 2014; date of current version April 10, This work was supported in part by the National Natural Science Foundation of China under Grants and , in part by the National Research Foundation for the Doctoral Program of Higher Education of China under Grant , and in part by the Key Program of Natural Science Foundation of Guangdong under Grant S The associate editor coordinating the review of this manuscript and approving it for publication was Dr. Patrick Bas. L. Guo and J. Ni are with the School of Information Science and Technology, Sun Yat-sen University, Guangzhou , China ( g.linjie@gmail.com; issjqni@mail.sysu.edu.cn). Y. Q. Shi is with the Department of Electrical and Computer Engineering, New Jersey Institute of Technology, Newark, NJ USA ( shi@njit.edu). Color versions of one or more of the figures in this paper are available online at Digital Object Identifier /TIFS x R n and y R n as the cover and stego images, respectively. We then define the cost (or distortion) function of making an embedding change at i-th element of x from x i to y i as ρ i (x i, y i ),where0 ρ i <. Under the additive distortion model, the total impact caused by the embedding can be expressed as the sum of embedding cost over all elements, i.e., D (x, y) = n i=1 ρ i (x i, y i ). In practice, the problem of designing a secure steganographic scheme can be formulated as the minimal distortion embedding, i.e., to minimize the total embedding distortion D for a given payload. With properly designed ρ i, the total statistical artifacts caused by the embedding are minimized and the resulting stego objects can be made less detectable. As JPEG is the most widely used format for digital image storage and transmission, JPEG steganography has become the domain of extensive research. It has witnessed the development of a lot of schemes for JPEG steganography over the last decade, such as F5 [2], nsf5 [3], MME [4] and some recently emerged adaptive ones [5] [7]. All of these schemes can be described with a unified framework the minimal distortion embedding framework, which consists of the coding unit and the distortion function. In the F5, the embedding impact is treated equally for each coefficient. As a result, minimizing the total distortion for a given payload corresponds to the effort to minimize the number of coefficients to be modified, or maximize the embedding efficiency, i.e., the number of message bits embedded per embedding change. The security performance of F5 was improved by increasing its embedding efficiency through matrix encoding, which can be viewed as a special case of the minimal distortion embedding framework with the embedding cost being identical for each coefficient. In [3], the wet paper code (WPC) is incorporated in nsf5, improved version of F5, to tackle the issue of shrinkage with F5, resulting in significant improvement in coding efficiency compared to the Hamming code used in F5. In the MME, for JPEG steganography, the advantage of the side-information of the original uncompressed image is taken to construct the distortion function, furthermore, only those coefficients with less distortion are selected to be modified, and more coefficients may be modified compared with the matrix coding. Later, Sachnev et al. proposed in [5] another efficient JPEG steganographic scheme, denoted as BCHopt, based on heuristic optimization and fast BCH syndrome coding. Compared with the MME, the BCHopt takes into account not only the rounding error but also the quantization step in the construction of distortion function, thus leading to significant improvement in security performance against steganalysis. The IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See for more information.

2 performance gain of both MME and BCHopt stems largely from the original BMP image as precover, which is, however, not always available in practice. In [1], Filler et al. proposed to use syndrome trellis coding (STC) as a practical approach for the implementation of minimal distortion embedding framework. They have shown that, under the additive distortion model, the STC can achieve asymptotically the theoretical bound of embedding efficiency for a user-defined distortion function. With the emergence of this efficient coding method, it is increasingly recognized in the steganographic community that further substantial increase in secure payload for steganography is more likely achieved by properly designing the distortion function rather than improving the coding scheme itself. In [6], Filler and Fridrich proposed a rich parametric model for the embedding cost at a specific coefficient by taking into account both the coefficient itself and its neighborhoods. By incorporating the STC, they optimized the constructed cost model with respect to the popular steganalysis feature set CC-PEV-548D [8]. The experimental results showed that the proposed distortion function, a.k.a. Model Optimized Distortion (MOD), can significantly improve the secure payload in DCT domain. However, as reported in a later paper by Kodovský et al. [9], the security performance of MOD can be drastically degraded as the distortion is optimized w.r.t. an incomplete feature space. By enlarging the corresponding parts of CC-PEV model, the MOD can be reliably detected by the IBC-EM feature set [9], and even becomes less secure than the heuristically designed nsf5. More recently, Holub and Fridrich proposed a universal distortion design called UNIWARD [10], in which the distortion functions for spatial (S-UNI), JPEG (J-UNI) and side-informed JPEG (SI-UNI) domain are derived from the wavelet domain. Unlike the conventional JPEG steganographic schemes which only embed the secret message into non-zero AC coefficients, the UNIWARD uses all DCT coefficients (DCs, zero and non-zero ACs) as possible cover elements for steganography, thus achieves so far the best security performance. Corresponding to the development of JPEG steganography, substantial progress has also been made recently in JPEG steganalysis. In [11], Kodovský and Fridrich suggested using a rich model with a large feature set of up to 22,510-D for steganalysis. By using the ensemble classifier [12], the rich model based steganalysis can detect most existing JPEG steganographic algorithms with a high accuracy. Consequently, the secure payload of JPEG steganography is decreased substantially, which poses new challenges on modern JPEG steganography. Therefore, there is an increasing need to develop more secure JPEG steganography algorithms. In general, a good JPEG steganographic scheme involves two aspects, i.e., an efficient steganographic coding unit and an effective distortion function which is correlated with the statistical detectability. In this paper, we focus on the design of a new additive distortion function for JPEG steganography. By following the concept in spirit of spread spectrum communication, the proposed distortion function is designed so as to guide the stego system to uniformly spread the embedding modification to the quantized DCT coefficients of all possible magnitudes. This results in possible minimal artifacts of first- and second-order statistics for DCT coefficients as a whole. It is noted that, for non side-informed JPEG steganography, our proposed distortion function is derived directly from the quantized block DCT coefficients without any premodel training. An efficient JPEG steganographic scheme is then developed by incorporating the new distortion function in the STC framework, which works quite well against the popular steganalyzers with various feature sets, e.g., CC-PEV-548D [8], IBC-EM-882D [9], MP-486D [13], and the recently emerged state-of-the-art feature set, CC-JRM- 22,510D [11]. In addition, if available, the original BMP image can be used as precover (side information) to further improve the security performance of our method. As an extension of our previous work in [14], this paper includes several new contributions: 1) the detailed analysis why the proposed UED function can lead to less average changes of second-order statistics besides the first-order ones; 2) the analysis of the allowable modification (embedding) rate of DCT coefficients with different magnitude from the perspective of natural image model; 3) the new scheme for side-informed JPEG steganography; and 4) implementation of all the experiments on the new BOSSbase [15] image database, which is widely considered as a more appropriate benchmark to evaluate the performance of the steganographic and steganalytic schemes. The remainder of this paper is organized as follows. In Section II, the adaptive steganographic framework for minimal distortion embedding is briefly reviewed. The proposed distortion function and the new JPEG steganographic scheme are presented in Section III and IV, respectively, which are followed by the experimental results and analysis in Section V. Finally the concluding remarks are summarized in Section VI. II. PRACTICAL MINIMAL DISTORTION EMBEDDING FRAMEWORK In steganography, the transmitter uses seemingly innocent media, e.g., digital images, to hide her messages and communicate with the receiver. In this way, it is hard to distinguish the stego media from the cover one, and thus covert communication can be achieved. In the literature, the message is generally hidden (embedded) in the cover image by slightly modifying some individual elements of cover, such as LSBs of pixels and quantized DCT coefficients. The problem of minimizing the embedding impact for single-letter distortion is well formulated in [1]. Let the binary vector x b = [x b1, x b2,...,x bn ], y b = [y b1, y b2,...,y bn ] {0, 1} n and m = [m 1, m 2,...,m k ] {0, 1} k be the LSB vector of cover x, LSB vector of stego y and message, respectively, we have the additive cost function as n D (x, y) = ρ i (x, y i ), (1) i=1 where ρ i (x, y i ) denotes the cost of changing the i-th cover element from x i to y i. With the syndrome coding, the minimal

3 Fig. 1. Comparison of statistics changes between nsf5 and the UED. (a) and (b) are the DCT coefficients histogram and the co-occurrence matrix of neighboring DCT coefficients for cover images. (c) and (d) are the histograms for the modified coefficients with nsf5 and the proposed scheme at 0.2 bpac, respectively. (e) and (g) are changes in statistics of (a) and (b) with nsf5. (f) and (h) are changes in statistics of (a) and (b) with the proposed scheme. distortion embedding framework is formulated as Emb(x, m) = arg min D (x, y) y b C(m) and H y b = m, (2) where H is parity-check matrix of the code C and C (m) is the coset corresponding to syndrome m. In the minimal-distortion embedding framework, most existing coding methods including Hamming code, BCH code and STC can be adopted. For practical design of steganography, the performance of coding method can be well evaluated using the metric of coding loss defined as the relative decrease in payload due to practical coding [1]: l(d ε ) = m MAX m, (3) m MAX where m is the payload embedded by a given algorithm and m MAX is the maximal payload embeddable with a distortion not exceeding D ε. Under this context, the Syndrome-Trellis Codes (STCs) [1] achieved an extremely low coding loss with l = 7% 14% depending on the parameter setting and thus is adopted in the construction of our proposed JPEG steganographic scheme. As for the distortion function, instead of training it against any specific feature set, we attempt to design a universal one to make the possible minimal artifacts of first- and secondorder statistics, which constitute the primitive elements of almost all feature sets for JPEG steganalysis. III. PROPOSED DISTORTION FUNCTION A. Motivation Behind Uniform Embedding Strategy To detect JPEG steganography, the statistics of quantized DCT coefficients are often exploited to construct feature set for steganalyzers. In practice, the histogram and the cooccurrence matrix of the block DCT coefficients are widely used in steganalysis. While the former relates to the firstorder statistics, and the latter corresponds to the second-order ones, which can capture the correlations among the DCT coefficients. Once a secret message (payload) is embedded into a JPEG image, the statistics of the DCT coefficients will be modified to some extent, which leaves trace for steganalysis. The impacts of data embedding on the statistics of DCT coefficients are well illustrated with nsf5 [3] as shown in Fig. 1. To be more specific, we randomly select 2,000 images from BOSSbase [15] and JPEG compress them with QF = 75. The average changes of statistics after steganography are then reported in Fig. 1. Fig. 1(a) shows the global histogram h of DCT coefficients X, and Fig. 1(b) corresponds to the co-occurrence matrix P (X 1, X 2 ) of coefficient X 1 and its neighboring one X 2 with offset d = (0, 1). For a given payload of 0.2 bpac, Fig. 1(c) shows the histogram of the DCT coefficients being selected to be modified by the nsf5 scheme, whereas Fig. 1(e) and (g) report the changes of h and P (X 1, X 2 ) after nsf5 embedding, respectively. As shown, most of the modifications of DCT coefficient are observed around bin zero. To gain insights on the artifacts we observe in Fig. 1, we now analyze how nsf5 works. For a given payload α, nsf5 embedding simulator [3] first calculates the theoretical bound of the embedding efficiency, and obtain the number n of the coefficients to be modified. Then, it randomly selects n nonzero AC coefficients and decreases their absolute value by 1. We use p (x) and p nz (x) to denote the empirical probability density function (PDF) of the AC and nonzero AC coefficients, respectively. There are n p nz (x) AC coefficients at bin x that needs to be modified. Therefore, we can express the change of PDF due to message embedding as p(x)= { n [p se1 (x 1)+ p se1 (x +1)]/N if x = 0 n [p se1 (x +sgn(x)) p se1 (x)]/n if x = 0, (4)

4 where p sel (x) = p nz (x) is the probability that coefficient x is selected and N denotes the total number of all the block DCT coefficients. Considering the fact that the block DCT coefficients are approximately Laplacian distributed and the random selection nature of nsf5, the coefficients to be modified are most likely those with small magnitude. As a result, most of the coefficient modifications due to this embedding strategy occur around bin zero. As observed in Fig. 1(c), most of the coefficients to be modified are located within bins of absolute value 2. According to (4), the changes of statistics in bin 0 and ±1 arising from random embedding are significantly larger than the ones in other bins as shown in Fig. 1(e). By exploiting the mentioned distribution artifacts of DCT coefficients with small magnitude ( X T ), even when the threshold T = 2, most existing JPEG steganalyzers, e.g., CC-PEV-548D [8] can detect JPEG steganography with high accuracy. For JPEG steganography, although the number of modified coefficients would be reduced if a more efficient coding strategy is adopted, the distribution of the modified coefficients, however, would remain similar after embedding. As a result, the substantial statistical artifacts of small DCT coefficients can still be made use of to detect stego JPEG images, especially when relative large data payload is required. To avoid the sudden change of statistics in small DCT coefficients, uniform embedding (UE) as formulated in (5) is more preferable rather than the random embedding strategy. p sel (x +sgn(x)) = p sel (x), x { 1024,..., 1, 1,...,1024}. (5) The uniform embedding strategy tries to spread the embedding modifications to coefficients of all possible magnitudes so as to minimize the statistics change in each bin, i.e., p(x +sgn(x)) = p(x), x { 1024,..., 1, 1,...,1024}. (6) To embed a given message M, let M be the total modifications, and RN and UN be the bin numbers involved in random and uniform embedding, respectively. The spread magnitude nature of uniform embedding makes UN RN, therefore the average modification per bin ( M / UN) for uniform embedding is much less than one ( M / RN) for random embedding. Note that, unlike OutGuess [16], our scheme seeks to minimize the change of the first-order statistics as well as the higher order ones. Take the P(X 1, X 2 ) in Fig. 1(b) for example, where a co-occurrence matrix (i.e., X i 10, i = 1, 2) averaged over 2,000 JPEG compressed images (QF = 75) is illustrated. The uniform embedding approach allows the modifications spreading over all quantized coefficients of different magnitudes, thus minimizing the change of each entry of P(X 1, X 2 ) asshowninfig.1(h). In addition, the proposed scheme neither modifies the zerocoefficients nor creates new zero-coefficients. In practice, the uniform embedding strategy can be implemented using STC [1]. To embed a given message, the STC provides multiple codewords, among which, a distortion function is then incorporated to choose the one with the least Fig. 2. Schematic illustration of the uniform embedding strategy. Curve a is the distribution of DCT coefficients. Curve b is the selection probability of each coefficient with UED. Curve c is the distribution of the selected coefficients. distortion. To be able to accomplish the uniform embedding, the involved distortion function should be designed so that the coefficients of different magnitude are selected with equal priority. In the following, we refer to such function as uniform embedding distortion function (UED). Let x denote the DCT coefficient, which is Laplacian distributed as shown in Fig. 2 (c.f. curve marked with a ). The distortion function used in UED should have the form of ρ (x) = 1 / x, i.e., the selection probability of a coefficient x is monotonically increased with its magnitude x as shown by the curve b in Fig. 2. Curve c in Fig. 2 shows the approximately uniform distribution of selected DCT coefficients when the UED is applied, which also corresponds to the less statistical detectability. B. Model of Natural Image It is obvious that the DCT coefficients with large amplitude tend to be modified more heavily than previous approaches, such as nsf5, when the strategy of uniform embedding is adopted. We then proceed to investigate the allowable modification (embedding) rate of DCT coefficients with different magnitude from the perspective of image model. The existing steganalysis analyzers for JPEG image generally take advantage of natural image model in terms of first- and second-order statistics of quantized DCT coefficients for steganalysis. If the distribution of DCT coefficients can be exactly characterized by some kind of image models, then any slight modification of the cover image will be reliably detected. Fortunately, the distributions of the DCT coefficients for natural images depend heavily on the image contents and vary from one to another. In other words, the statistics of natural images indeed exhibit, to some extent, deviation away from their models of any kinds, which are what the potentials of natural images left for steganography. To justify the deviation of natural images in terms of first- and second-order statistics, we again randomly selected 2,000 JPEG images from the image database BOSSbase [15]. The histogram of DCT coefficients p(x) of each image is first calculated. And the mean value μ(x) and standard deviation σ(x) of p(x) are then obtained, respectively, as shown in Fig. 3(a) and (b). The existence of σ(x) indicates the dispersion of natural images in first-order statistics, which is more appropriate to be measured using the normalized coefficient of variation (CV) [17] defined as the ratio of the standard deviation to the mean: Cv(x) = σ(x) μ(x). (7)

5 Fig. 3. (a) (c) and (d) (f) are the mean, standard deviation and CV of p(x) and P(X 1, X 2 ) over 2,000 JPEG image, respectively. As is shown in Fig. 3(c), Cv(x) increases with x, which implies that, for natural images, the histogram of quantized DCT coefficients p(x) tends to deviate heavily when the magnitude of coefficients (i.e., x ) increase. Therefore, if the relative modification rate of each x is proportional to its CV so as to make the uniform modification across all x, the statistical impact in first-order statistics could be minimized. The similar effect is also observed with second-order statistics of natural images. Let P(X 1, X 2 ) denote the cooccurrence matrix with offset d = (0, 1). Fig. 3(d) (f) show the mean μ(x 1, X 2 ), standard deviation σ(x 1, X 2 ) and normalized coefficient of variation Cv(X 1, X 2 ) of P(X 1, X 2 ) over 2,000 JPEG images with QF = 75, respectively. Obviously, Cv(X 1, X 2 ) also increases with the increase of X 1 + X 2. In other words, it is more difficult to model the second-order statistics of DCT coefficients when X 1 + X 2 gets larger. Therefore, the statistical impact of modifying a DCT coefficient x depends on its own magnitude x as much as on the magnitudes of its neighboring coefficients. C. Distortion Function for the Uniform Embedding Strategy 1) Single Coefficient Based Uniform Embedding Distortion: Let c ij denote the DCT coefficient at (i, j), the distortion function of form 1 / cij is well explained with the concept of uniform embedding. It is intuitive to define the single coefficient based uniform embedding distortion function (SC-UED) as below: ρij SC = cij 1. (8) With SC-UED and the STC framework, for 2,000 JPEG images with QF = 75, the statistics changes after steganography of 0.2 bpac are also shown in Fig. 1. It is observed that the selected coefficients are much more uniformly distributed [Fig. 1(d)] than the ones with random selection of nsf5 [Fig. 1(c)]. Compared to Fig. 1(e) and (g) of nsf5, the uniform embedding has a quite uniform distribution and much less average changes in first- and second-order statistics, e.g., the global histogram and co-occurrence matrix with offset d = (0, 1), as shown in Fig. 1(f) and (h). No notable sudden changes in statistics are observed, especially in the region of small coefficients, say, [ 2, 2]. 2) Joint Coefficients Based Uniform Embedding Distortion: The SC-UED is employed to effectively relieve the sudden statistical changes, especially for the first-order statistics, due to random embedding. To survive the attacks of existing and emerging steganalysis tools [8], [11], [13], a better distortion function should be devised to allow a more uniform change of both first- and second-order statistics. For JPEG steganalysis, the second-order statistics of the DCT coefficients are generally characterized with co-occurrence matrix, i.e., P(X 1, X 2 ), where X 1 and X 2 are the quantized DCT coefficient and its neighboring one with offset d, respectively. Following the concept of SC-UED, and noting the fact that the quantized DCT coefficient pair (X 1, X 2 ) is generally 2-D Laplacian distributed, the (X 1, X 2 ) with larger magnitude should be modified with priority during embedding. Therefore, to design the practical UED for a quantized DCT coefficient, besides the magnitude of the DCT coefficient itself, the ones of its intra- and inter-block neighborhood coefficients which are assumed to have the strongest magnitude correlation with the coefficient under consideration, should be taken into account. The developed distortion function is known as the joint coefficients based uniform embedding distortion (JC-UED) and

6 Fig. 4. (a) (b) are changes of co-occurrence matrix with offset d = (0, 1) and d = (0, 8) of SC-UED, respectively. (c) (d) are same statistics changes of JC-UED. The payloads are both 0.2 bpac. described in (9) ρij JC = ( ) cij 1 + dia + α ia d ia N ia + d ir N ir ( c ij + d ir + α ir ) 1, (9) where N ia = {c i+1, j, c i 1, j, c i, j+1, c i, j 1 } and N ir = {c i+8, j, c i 8, j, c i, j+8, c i, j 8 } are intra- and inter-block neighborhoods of coefficient c ij, respectively. When the considered coefficient c ij is located in the image boundary, the nonexistent coefficients are removed from (9) accordingly. α ia and α ir are adjustment parameters and determined experimentally as 1.3 and 1, respectively, as in [14]. The way how these two parameters are experimentally determined is as below: 1) Randomly select 2,000 images from the image database described in [14], and set a fixed payload (e.g. 0.3 bpac); 2) Estimate the error probability with the CC-JRM features utilizing the ensemble classifier on the grid: A ia A ir, where A ia = {0, 0.1,...,1.9, 2} and A ir ={0, 0.1,...,1.9, 2}; 3) Select the best parameter pair with the minimum error probability as α ia and α ir. According to our experiments, the variations of the estimated parameters α ia and α ir are little for different image database. Fig. 4 shows the changes of second-order statistics with different distortion functions, where Fig. 4(c) and (d) are changes of co-occurrence matrix of offset d = (0, 1) and d = (0, 8) with JC-UED, compared with ones of the same offset with SC-UED in Fig. 4(a) and (b), suggesting that the JC-UED can well improve the sudden changes of the second-order statistics changes. Or, in other words, the JC-UED makes both the first- and second-order statistics change more uniformly. 3) Side-Informed Uniform Embedding Distortion: In general, the original BMP image as side-information can help to design efficient JPEG steganographic scheme [4], [5], [7]. Although the original BMP image is not necessary in the construction of UED, it is expected that the performance of the proposed scheme can be greatly improved by taking into account the side-information when it is available. The developed distortion function is referred to as side-informed uniform embedding distortion (SI-UED), which should satisfy both the requirements of uniform embedding and minimizing the absolute distortion, i.e., the additional rounding error as well. With the original BMP image, the rounding error R due to JPEG compression and the embedding error R due to data embedding are readily obtained. Thus we have the resulting additional rounding error E = R R, which is incorporated in the construction of SI-UED and has to be minimized. As a result, the SI-UED is defined as ρ SI ij = e ij [ d ia N ia ( c ij + d ia +α ia ) 1 + d ir N ir ( c ij + d ir +α ir ) 1], (10) where e ij is the additional rounding error for c ij, α ia and α ir are adjustment parameters determined experimentally as 0.2 (obtained using the similar procedure described in the previous subsection), other parameters are similarly defined as the ones in (9). The MME [4] is the first side-informed JPEG steganographic scheme that tried to improve its security performance by minimizing the additional rounding error. According to [4], modifying the coefficients with rounding error closer to 0.5 leads to less additional rounding errors. The BCH [5] and EBS [7] are also side-informed schemes that utilizing the rounding error. The feasibility of the SI-UED is illustrated in Fig. 5, where the average distributions of rounding error, i.e., frequency vs. rounding error [Fig. 5(a), (c), (e), and (g)] and the average changes in global histogram [Fig. 5(b), (d), (f), and (h)] for MME, BCH, EBS and SI-UED over 2,000 images randomly selected from the BOSSbase with a payload of 0.3 bpac are included. For fair comparison, all the four schemes are STC coded. It is observed that all the four schemes tend to modify more coefficients with rounding error close to 0.5, whereas less coefficients with rounding error close to 0. Compared with Fig. 5(a) and (c), the SI-UED modifies a little bit more coefficients with rounding error close to 0. This is because the SI-UED has to take the uniform embedding strategy into account at the same time, which consequently leads to much less statistical changes as shown in Fig. 5(h). Fig. 5(b), (d), (f), and (h) are average changes in global histogram caused by the MME, BCH, EBS and SI-UED, respectively. Again, compared with SI-UED [Fig. 5(h)], it is noted that the other schemes give rise to a much more sudden changes in the bins around zero coefficient as shown in Fig. 5(b), (d), and (f), as nsf5 does, especially the MME. IV. PROPOSED JPEG STEGANOGRAPHIC SCHEME The objective of minimal distortion embedding framework is to improve the security performance of steganography.

7 Fig. 6. Proposed scheme. (a) Data embedding. (b) Data extraction. available for a more secure data embedding. Let c = { c } k and c = {c k } be the quantized DCT coefficients before and after rounding operation, respectively. Then the rounding error is obtained with r k = c k c k. Case 2: When the input image is in JPEG format, the entropy decoding is applied to generate the quantized DCT coefficients c directly. In both cases, we obtain the scrambled non-zero AC coefficients x from c by a shared key K, i.e., x = f nz (c, K) = {x k }, (11) Fig. 5. (a), (c), (e) and (g) are the average distribution of the rounding errors of the modified coefficients over 2,000 images for MME, BCH, EBS and SI-UED, respectively; (b), (d), (f) and (h) are average changes in global histogram over 2,000 images for MME, BCH, EBS and SI-UED, respectively. All of the four schemes are STC coded with a payload of 0.3 bpac. To this end, syndrome coding incorporating some distortion functions is employed, specifically the syndrome-trellis coding (STC) [1] for data embedding and the proposed distortion functions (JC-UED or SI-UED) for embedding efficiency optimization. Fig. 6 illustrates the unified framework for JPEG steganography with original BMP image (Case 1) or JPEG compressed image (Case 2) as input, which includes the process of data embedding and extraction. A. Data Embedding 1) Preprocessing: The preprocessing is adopted to generate the cover, i.e., the quantized DCT coefficients for data embedding. Case 1: When input image is original BMP image, the process starts from the implementation of JPEG compression. In this way, the side-information, i.e., the rounding error is where ( f nz () is the mapping function. Similarly x = f nz x, K ) = { x k} denotes the scrambled non-zero AC coefficients before rounding. 2) Embedding Operation: Let y = {y k } and be the scrambled stego DCT coefficients and embedding operation, respectively. For scrambled AC coefficients x = {x k }, we have y k = x k + k. Before evaluating the distortion of a modified coefficient, the embedding operation itself should be defined. Case 1: With the original BMP image, the embedding operation is defined as below, +1, if r k 0&x k = 1 1, if r k 0&x k = 1 k =. (12) 1, if r k > 0&x k = 1 +1, if r k > 0&x k = 1 The embedding error due to data embedding is r k = y k x k = x k + k x k = k + r k 1 + r k, if r k 0&x k = r k, if r k 0&x k = 1 = 1 + r k, if r k > 0&x k = r k, if r k > 0&x k = 1 1 r k, if r k 0&x k = 1 r k = 1 + r k, if r k 0&x k = 1 1 r k, if r k > 0&x k = r k, if r k > 0&x k = 1 { 1 + r k, if x k r k > 0& x k =1 =. (13) 1 r k, otherwise

8 Thus we have the resulting additional rounding error e k = r k { r k 1, if x k r k > 0& x k =1 =. (14) 1 2 r k, otherwise Case 2: When the side-informed original BMP image is not available, the embedding operation is simply defined as { sgn(x i ), if x k =1 k = ±1, if x k = 1. (15) In both cases, we increase the absolute value of those ±1 cover coefficients by 1 so that no additional zero DCT coefficients are created. 3) Distortion Calculation: Case 1: Compute the embedding distortion ρ ={ρ k } for each scrambled non-zero AC coefficient x k using the SI-UED defined in (10), where the additional rounding error is computed as (14). Case 2: Compute the embedding distortion ρ ={ρ k } for each scrambled non-zero AC coefficient x k using the JC-UED defined in (9). 4) STC Coding: Case 1: Since the embedding operation is deterministic as in (12) which is guided by the rounding error, we can only use the binary STC. Let the binary vector m = {m i } and x b = {x bi } be the secret message and LSB of cover x, respectively. With m, x b and its corresponding embedding cost ρ as input parameters, the binary STC coding [1] is then applied to embed secret message m to x. The output of STC is the stego x b for x b, which is then used to construct the modified pattern p = xor(x b, x b ) of scrambled non-zero AC coefficients x. Case 2: Unlike case 1, the embedding operation is nondeterministic as in (15) except that x k =1. Since embedding operation can randomly be +1 or 1, this allows us to use the ternary STC to further improve the security performance. With m, x and its corresponding embedding cost ρ as input parameters, the ternary STC coding [1] is then applied to embed secret message m to x. And the output of STC is directly the stego y. 5) Postprocessing: Case 1: Once the modified pattern p = xor(x b, x b ) is obtained, the cover x is modified with (16) to obtain stego y. k is defined in (12). { x k, if p k = 0 y k = (16) x k + k, if p k = 1 For both cases, the entropy coding is then applied to generate stego JPEG image after y is descrambled. B. Data Extraction 1) Preprocessing: For a stego JPEG image, the quantized DCT coefficients are obtained by entropy decoding, which are then scrambled with the shared key K to generate the scrambled non-zero AC coefficient y. 2) STC Decoding: The STC decoding (binary STC for Case 1 and ternary STC for Case 2) is then applied to extract the secret message m. V. EXPERIMENTAL RESULTS AND ANALYSIS In this section, experimental results and analysis are presented to demonstrate the feasibility and effectiveness of the proposed UED schemes. The comparisons with several state-of-the-art schemes, such as nsf5 simulator [3], Filler et al. s adaptive scheme with model optimized distortion (MOD) [6] and Holub et al. s J-UNI [10] for non sideinformed JPEG steganography, and, Kim et al. s modified matrix encoding (MME) [4], Wang et al. s block entropy weighted scheme (EBS) [7], Sachnev et al. s BCH and BCHopt [5], and Holub et al. s SI-UNI [10] for side-informed JPEG steganography, are included. Note that, in all the involved schemes, with the exception of J-UNI, SI-UNI and BCHopt, other schemes including the proposed UED embed the secret message only to the non-zero AC coefficients and fall into the realm of conventional JPEG Steganography. In our experiments, we concentrate on the comparison of the distortion functions for the involved schemes. Therefore, the Hamming code in MME and BCH code in BCH are replaced with STC in the interest of fair comparison. Moreover, the proposed SI-UED will utilize both STC and BCH code when compared with BCHopt in [5]. A. Experiment Setup All experiments are carried out on the image database BOSSbase [15]. The original database contains 10,000 images acquired by eight digital cameras in their RAW format (CR2 or DNG) and subsequently processed by converting to grayscale, and then resizing and cropping to the size of pixels using the script available from [15]. The images in BOSSbase are then JPEG compressed using quality factors 75, 85 and 95. Thus, we have four image databases each with 10,000 grayscale cover images of different texture characteristics in format of BMP and JPEG, which serve as the precover (BMP) and cover (JPEG) for side-informed and non sideinformed JPEG embedding, respectively. In our experiments, the payloads for both non side-informed and side-informed embedding range from 0.1 to 0.5 bpac with a step of 0.1. Several mainstream universal feature sets for JPEG steganalysis, such as the CC-PEV-548D [8], MP-486D [13] and the state-of-the-art CC-JRM-22,510D [11], are employed to evaluate the security performances of the involved JPEG steganographic schemes. Considering the proposed UED tends to spread the embedding to all possible quantized DCT coefficients with different magnitude, the IBC-EM-882D feature set in [9], which focuses on detecting the embedding changes to DCT coefficients with a large magnitude, is also included in our experiments. The ensemble classifier in [12] is incorporated in our experiments as is done in [11], since it enables fast training in high-dimensional feature spaces and has a comparable performance to that of SVMs [18] working on low-dimensional feature sets. Considering the CC-PEV-548D, MP-486D and IBC-EM-882D are originally designed for SVM, we also utilize the SVM as the classifier for these three feature sets. The parameters of SVM are set as in [8], [9], and [13], respectively. For the cover and their corresponding stego images with different steganographic schemes, embedding rates and

9 TABLE I D ETECTION E RRORS FOR THE I NVOLVED N ON S IDE -I NFORMED AND S IDE -I NFORMED S CHEMES ON BOSS BASE W ITH CC-PEV-548D, MP-486D AND IBC-EM-882D, AND E NSEMBLE AND SVM C LASSIFIERS F OR Q UALITY FACTORS 75 QFs, the feature sets for the involved steganalysis tools are extracted, where half of the cover and the stego features are used as the training set for both the ensemble and SVM classifiers, and the remaining half are used as test set to evaluate the trained classifier. The minimal total error PE under equal priors achieved on the test set is defined as PFA + PMD (PFA ), (17) 2 where PFA is the false alarm rate and PMD is the missed detection rate. The performance is evaluated using the median value of PE over ten random tests and is denoted as P E. PE = min PFA B. Performance of Non Side-Informed UED For JPEG steganography without side-information, we compare the proposed SC-UED and JC-UED with nsf5 [3], MOD [6] and the recently proposed J-UNI [10]. The security performances of the involved schemes against the CC-JRM-22,510D, for JPEG quality factors 75, 85 and 95, are illustrated in Fig. 7. For all cases, J-UNI achieves the best security performance as expected, while JC-UED clearly outperforms nsf5 as well as MOD by a sizeable margin across all three quality factors. We also report in Table I the security performances of the involved non side-informed and side-informed schemes against the CC-PEV-548D, MP-486D and IBC-EM-882D, with both ensemble and SVM classifiers, for JPEG quality factor 75. Again, for all cases, J-UNI achieves the best security performance. For CC-PEV-548D and MP-486D with both ensemble and SVM classifiers, both JC-UED and SC-UED have considerably better performance than that of nsf5 for all tested payloads, and JC-UED outperforms MOD for medium and

10 Fig. 7. Detection errors as a function of relative payload for nsf5, MOD, J-UNI, SC-UED and JC-UED on BOSSbase with CC-JRM-22,510D and ensemble classifier for (a) QF = 75, (b) QF = 85 and (c) QF = 95. MOD, J-UNI, SC-UED and JC-UED are ternary STC coded. Fig. 8. Detection errors as a function of relative payload for MME, BCH, BCHopt, EBS, SI-UNI and SI-UED on BOSSbase with CC-JRM-22,510D and ensemble classifier for (a) QF = 75, (b) QF = 85 and (c) QF = 95. MME, BCH, EBS and SI-UNI are binary STC coded, BCHopt is BCH coded, and SI-UED is both binary STC and BCH coded. low payloads. It is noted that the MOD is optimized to CC-PEV-548D [8]. Even under this circumstance, the JC-UED still has a better performance than the one of MOD for most of the tested payloads, and is only slightly outperformed by MOD for large data payload ( 0.4 bpac) when both JC-UED and MOD can be reliably detected by CC-PEV-548D. Table I also shows the performance of the involved non side-informed schemes against the feature set IBC-EM-882D [9], which consists of the enlarged interblock co-occurrence and the extended Markov features by increasing the corresponding threshold T, respectively, which are devised to detect the embedding changes in DCT coefficients with a large magnitude. It is observed that, for various payloads, JC-UED, SC-UED, J-UNI and nsf5 with IBC-EM-822D can achieve a better and comparable performance than their corresponding ones with CC-PEV-548D and MP-486D, whereas the performance of MOD can fall significantly when IBC-EM-822D is applied, suggesting that: 1) the distortion function in MOD is somewhat overtraining to the incomplete cover model CC-PEV-548D and can be reliably detected by the IBC-EM features; 2) the proposed UED spreads uniformly its embedding changes to all possible quantized DCT coefficients with different magnitude and thus leads to much less sudden changes even for those coefficients with relatively large magnitude. It is readily seen from Table I that, for IBC-EM-882D, the proposed JC-UED and SC-UED work considerably better than nsf5, while the MOD can still be reliably detected for all the tested payloads. It is noted that the proposed distortion function in JC-UED uses only coefficients in DCT domain without transformation to other domains, while the J-UNI uses spatial domain distortion for JPEG steganography, which is quite time-consuming. In addition, unlike the conventional approaches, the J-UNI uses all DCT coefficients as possible cover elements, and a sizeable proportion of DC and zero AC coefficients are incorporated in the J-UNI for JPEG steganography. J-UNI currently seems to work better, perhaps because there are no features yet that would detect it, especially those changes in DC and zero AC coefficients. Therefore, at least, in the framework of conventional JPEG steganography, the proposed JC-UED method can still provide the best security performance. C. Performance of Side-Informed UED For JPEG steganography with side-information, we compare the proposed SI-UED with MME [4], BCH [5], BCHopt [5], EBS [7] and recently proposed SI-UNI [10]. Fig. 8 shows the security performance of the involved schemes against the CC-JRM-22,510D, for JPEG quality factors 75, 85 and 95. Note that the schemes in Fig. 8(a) (c) are all binary STC coded except the BCHopt for fair comparison. By BCH and

11 Fig. 9. Detection errors as a function of relative payload for SC-UED, JC-UED and SI-UED on BOSSbase with CC-JRM-22,510D and ensemble classifier for (a) QF = 75, (b) QF = 85 and (c) QF = 95. SC-UED and JC-UED are ternary STC coded, while SI-UED is binary STC coded. BCHopt, we mean the baseline distortion function and its enhanced version used in [5] for non zero AC coefficients and all possible AC coefficients (non-zero and zero ACs), respectively. As in the non side-informed case, the SI-UNI achieves the best security performance for almost all cases except that it is slightly outperformed by the SI-UED when the payload is 0.10 bpac for JPEG quality factor 95, while the proposed SI-UED has a significantly better performance than the ones of MME and BCH and outperforms EBS by a clear margin for all tested payloads. Note that BCHopt can only be implemented with fast BCH syndrome coding and has long been known as one of the most secure side-informed steganographic schemes for its heuristic optimization [5]. To verify the superiority of SI-UED is irrelevant to the used code, Fig. 8(a) (c) further compare the SI-UED with BCHopt when both of the schemes are BCH coded. Again, the SI-UED performs much better than BCHopt for all tested payloads across all three quality factors. We also report the security performances of the involved side-informed schemes against the CC-PEV-548D, MP-486D and IBC-EM-882D, for JPEG quality factor 75 in Table I. Again SI-UNI achieves the best security performance, and the SI-UED outperforms all other schemes when encoded with binary STC, and also outperforms the BCHopt when encoded with BCH code for all tested payloads and classifiers. The pros and cons between SI-UED and SI-UNI are similar to the ones between JC-UED and J-UNI as described in Section V.B. Fig. 9 illustrates the performance comparison of the non side-informed SC-UED and JC-UED, and the side-informed SI-UED, against the feature set CC-JRM-22,510D with quality factors 75, 85 and 95. For almost all the cases, the SI-UED with binary STC achieves the best performance, even though the SC-UED and JC-UED are both ternary STC coded, indicating that the precover as side information may contribute more to the improvement of the security performance than simply increasing the coding efficiency by using M-ary Code. VI. CONCLUSION Minimal-distortion embedding framework is a practical approach to implement JPEG steganography with high embedding efficiency. In this paper, an efficient JPEG steganographic scheme which utilizes syndrome trellis coding (STC) and uniform embedding (UE) strategy is presented. The uniform embedding is similar in spirit to spread spectrum communication. By uniformly spreading the embedding modifications to quantized DCT coefficients of all possible magnitudes, the average changes of first- and second-order statistics are possibly minimized, especially in the small coefficients, which leads to less statistical detectability, and hence, more secure steganography. A class of new distortion functions known as uniform embedding distortion function (UED) for both non side-informed and side-informed JPEG steganography are developed to incorporate the uniform embedding. The JC-UED for non side-informed embedding takes into account the magnitude of DCT coefficient as well as both its intraand inter-block neighborhood coefficients, while the SI-UED for side-informed embedding further explores the additional rounding error besides the requirement of uniform embedding. Extensive experiments have been carried out to demonstrate the superior performance of the proposed scheme in terms of secure embedding payload against steganalysis. Finally, it is worthwhile to note that, the inappropriate use of DC and zero AC coefficients in JPEG steganography may lead to additional block artifacts in stego image and decrease in the efficiency of JPEG compression, respectively. That is why the most existing JPEG steganographic schemes use only non-zero AC coefficients as possible cover elements to make the embedding naturally content-adaptive. With the carefully devised distortion function, however, the embedding should be made artificially content-adaptive in principle. According to some of our experiments, some DC and zero AC coefficients in the texture regions could indeed be incorporated to further data embedding without decreasing, even increasing the security performance. While the UED proposed in this paper could by no means tackle all of these issues, it raises a quite challenging open question, that is how to evaluate the embedding costs of all possible DCT coefficients (including DCs, zero and nonzero ACs) based solely on the coefficients in the DCT domain for JPEG steganography, which remains as the topic of our future research effort. ACKNOWLEDGMENT The authors would like to thank the anonymous reviewers and associate editor for their comments that greatly improved the manuscript.

12 REFERENCES [1] T. Filler, J. Judas, and J. Fridrich, Minimizing additive distortion in steganography using syndrome-trellis codes, IEEE Trans. Inf. Forensics Security, vol. 6, no. 3, pp , Sep [2] A. Westfeld, F5 A steganographic algorithm, in Proc. 4th Inf. Hiding Conf., vol , pp [3] J. Fridrich, T. Pevný, and J. Kodovský, Statistically undetectable JPEG steganography: Dead ends challenges, and opportunities, in Proc. 9th ACM Workshop Multimedia Security, Dallas, TX, USA, Sep. 2007, pp [4] Y.Kim,Z.Duric,andD.Richards, Modifiedmatrixencoding technique for minimal distortion steganography, in Proc. 8th Inf. Hiding Conf., vol Jul. 2006, pp [5] V. Sachnev, H. J. Kim, and R. Zhang, Less detectable JPEG steganography method based on heuristic optimization and BCH syndrome coding, in Proc. 11th ACM Workshop Multimedia Security, Sep. 2009, pp [6] T. Filler and J. Fridrich, Design of adaptive steganographic schemes for digital images, Proc. SPIE, vol. 7880, p F, Jan [7] C. Wang and J. Ni, An efficient JPEG steganographic scheme based on the block entropy of DCT coefficients, in Proc. IEEE ICASSP, Kyoto, Japan, Mar. 2012, pp [8] J. Kodovský and J. Fridrich, Calibration revisited, in Proc. 11th ACM Workshop Multimedia Security, New York, NY, USA, Sep. 2009, pp [9] J. Kodovský, J. Fridrich, and V. Holub, On dangers of overtraining steganography to incomplete cover model, in Proc. 13th ACM Workshop Multimedia Security, New York, NY, USA, Sep. 2011, pp [10] V. Holub and J. Fridrich, Digital image steganography using universal distortion, in Proc. 1st ACM Workshop Inf. Hiding Multimedia Security, 2013, pp [11] J. Kodovský and J. Fridrich, Steganalysis of JPEG images using rich models, Proc. SPIE, vol. 8303, p A, Jan [12] J. Kodovský, J. Fridrich, and V. Holub, Ensemble classifiers for steganalysis of digital media, IEEE Trans. Inf. Forensics Security, vol.7, no. 2, pp , Apr [13] C. Chen and Y. Q. Shi, JPEG image steganalysis utilizing both intrablock and interblock correlations, in Proc. IEEE Int. Symp. Circuits Syst., Mar. 2008, pp [14] L. Guo, J. Ni, and Y. Q. Shi, An efficient JPEG steganographic scheme using uniform embedding, in Proc. 4th IEEE Int. Workshop Inf. Forensics Security, Tenerife, Spain, Dec. 2012, pp [15] P. Bas, T. Filler, and T. Pevný, Break our steganographic system The ins and outs of organizing boss, in Proc. 13th Inf. Hiding Conf., 2011, pp [16] N. Provos, Defending against statistical steganalysis, in Proc. 10th USENIX Security Symp., Washington, DC, USA, 2001, pp [17] D. Freedman, Statistical Models: Theory and Practice. Cambridge, U.K.: Cambridge Univ. Press, [18] C.-C. Chang and C.-J. Lin, LIBSVM: A library for support vector machines, ACM Trans. Intell. Syst. Technol., vol. 2, no. 3, pp. 27:1 27:27, Linjie Guo (S 12) received the B.S. degree in engineering from the South China University of Technology, Guangzhou, China, in He is currently pursuing the Ph.D. degree with the School of Information Science and Technology, Sun Yat-sen University, Guangzhou. His current research interests include steganography, steganalysis, and multimedia security. Jiangqun Ni (M 12) received the Ph.D. degree in electronic engineering from the University of Hong Kong, Hong Kong, in He was a Post-Doctoral Fellow for a joint program between the Sun Yat-sen University, Guangzhou, China, and the Guangdong Institute of Telecommunication Research from 1998 to Since 2001, he has been with the School of Information Science and Technology, Sun Yat-sen University, where he is currently a Professor. His research interests include data hiding and digital image forensics, image-based modeling and rendering, and image/video processing. He has authored more than 50 papers in these areas. Yun Qing Shi (M 88 SM 92 F 05) has been with the New Jersey Institute of Technology, USA, since He received the M.S. degree from Shanghai Jiao Tong University, China, and the Ph.D. degree from the University of Pittsburgh, USA. His research interests include digital data hiding, forensics and information assurance, and visual signal processing and communications. He has authored and coauthored more than 300 papers, one book, and five book chapters, and has edited 10 books. He holds 28 U.S. patents. He received the Innovators Award 2010 from the New Jersey Inventors Hall of Fame for Innovations in Digital Forensics and Security. His U.S. patent 7,457,341 titled System and Method for Robust Reversible Data Hiding and Data Recovery in the Spatial Domain received the 2010 Thomas Alva Edison Patent Award from the Research and Development Council of New Jersey. He served as an Associate Editor of the IEEE TRANSACTIONS ON SIGNAL PROCESSING and IEEE TRANSACTIONS ON CIRCUITS AND SYSTEMS (II), and a few other journals, the Technical Program Chair of the 2007 IEEE International Conference on Multimedia and Expo, a Co-Technical Chair of the 2006, 2007, and International Workshop on Digital Watermarking, and the 2005 IEEE International Workshop on Multimedia Signal Processing (MMSP), a Co-General Chair of the 2002 IEEE MMSP, and a Distinguished Lecturer of the IEEE Circuits and Systems Society. He is a member of a few IEEE technical committees.